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DECLARATION OF PRIOR INVENTION IN THE UNITED STATES 
OR IN A NA FTA OR WTO MEMBER COUNTRY 
TO OVERCOME CITED PATENT OR PUBLICATION (37 C.F.R. $ 1.131) 

NOTE- 37 C.FJI § 1.131 A^davft or dedanation ot prior invention. 

fat men any daint of an appScathn or a patent under leoxanikKdion Is rejected, the Inventory 

the ad^ject matter of the reeded claim, the ovmer of the patetd under te&atdnaSon. or the party 
qualified under §§ 1.42, 1.43, or 1.47, may aubmit an appropriate oath or dedarathn to estdiBsh 

inverOon d the subjed rtiatter of the reeded datei prior to the emotive date of the tddence or 

adMty on which the idedion is based. The effective date of a U.S. patent, U.S. patent application 
publication, or Intemational application publication under PCT Artlde 21(2) is the eatSer of Its 
pubBcation date or date that It is effective as a reference under 35 U.S.C. 10^). Prior Invention may 
not be estdrBshed under this section In any country oUter than the Udted Stales, a NAFTA country, 
or a WTO member country. Prior kwerOon may not be estabSshed under this section bdMvDecemb^ 
a. 1993, inaNAFTAcountryotherthan the UnitedStates.orbefore January 1 . 1996, in a WTO member 
country other than a NAFTA country. Prior invention rna^ not be estabBshed under this section If either: 

CERTIFICATION UNDER 37 C.FJL f | 1.3(a) and 1.10* 

(When udrrg Express Mail, the Express MaB label number is mandatory; 

Express MaB certification Is optional.) 

I hereby certify that, on the date shown below, this correspondence b being: 

MAILMG 

□ deposited with the United States Postal Service in an envelope addressed to Commissioner for Patents, P.O 

Box 1450. Alexandria, VA 22313-1450 



37 CJJI. § IJKa) 37 CJ.R. § 1.10 * 

□ with sufficient postage as first class mail. □ as ‘Express MaU Post Office to Addressee* 





Mailing label Nn 

TRANSMISSION 




□ facsimfie transmitted t 


0 the Patent and Trademark <Xfice, (571) 273-8300. J 


r 


X E-filed 






nate- 02/27/2008 


Signat^ 

Jerthifer Smith 





(fype or print name of person certifyinsfl 



* OtBy the date of mng (§ 1.6) wBI be the date used In a patent term acgusbnent calculation, aithou^ the date 
on any certificate of mailing or transmisdon under § 1.8 continues to be taken Into account in determining 
timeliness. See § 1.703(0. Consider 'Express Mail Post Office to Addressee’ (§ 1. 10) or tecsimBe transmission 
(§ 1.9(c0) for the reply to be accorded the earliest possible Wng date for patent term adjustment calculations. 
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(1) The r^ecSon fa based upon a U.& patent or US. patent af^icaHon publication of a pending 
or patented apfdkab'on to anther or tuiNdt claims the same patentable invention as defined 

in § 1.601^; or 

0 The r^ecOon Is based t^xm a statutory bar. 

PURPOSE OF DECLARATION 



1. This declaration is Jo establish completion of the invention of this appHcation in 



m 

□ 


the United States 
the NAFTA country 


(name nf 


□ 


the WlPO country 


(name rtf mnntry^ 


date 


prior tn March 08. 2004 


_ that is the effective date of the prior art 



□ publication 



m 


patent publication 2003 /148159 


□ 


other. 



that was cited by the 
[H examiner. 

□ applicant 

W07E- 37 C.ER. § 1.131 Is not appScable to a ejection based on a US. patent that CLAMS the reeded 
bwendon. 

2. The person making this declaration Is (are): 

□ the inventor(s). 

□ only some of the joint inventor(^ (and a suitable excuse is attached for falhire 
of the omitted joint inventor(s) to sign) 

13 the party In Interest (and a suftabfe &cf^anation as why it Is not possible to 
produce the dedaratiM of the inventof(s) is attached) - The documents (invention 
Disclosure and email) speak for themselves . 

FACTS AND DOCUMENTARY EVIDENCE 



NOTE: "Theshowingof facts shat be such. In character and weight, as to estabibh reduction to practice prior 
to the e^cBve date of Ote reterence. or conceptio n of tte bwenlion priot to the dfecihm date of the 
refdence coupled with due dXgenca tom prior to said date to a subsequent reduction ptacSce or 
to the filing of the appBcadon. Original e^tMts of drawings or tecotxis, or photocopies thereof, must 
accompany and form part of the afBdavit Or dedatabon or their absence saHsfactoray explained.’ 37 
CJ=.FL § 1.131(bj. 



See Rule 131 Affidavit 
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(ReU0fr~4A)6 Pub.fiOSi 



form 9-32 



9-194 




(Rd.99— SAM Pub.605) 



FORM 9-32 



9-195 



3. To establish the date of completion of the invention of this application, the following 
attached documents and/or models are submitted as evidence: 

(check eJI af^icable items t3elow) 

□ sketches 

□ blueprints 

□ photographs 

□ reproduction(s) of notebook entiles 

O model 

□ supporting statement(s) by witne^es) (where verbal disclosures are the evi- 
dence relied upon ) 

□ interference testimony 

0 disclosure documents and email from Clark Jeffries dated December 08,2003' 

NOTE- VMe conception is the mentai part of the Inventive act, it must be capable of proof, such as by 
demonstrative evidence or by a complete cSsdosure to another. Conception is more than a vague idea 
of how to solve a problem. The requisite means themselves and thek interaction must also be 
con^rehendecL See Mergenthaierv. Scudder 1897 CD. 724, 81 0.G. 1417.’ See tiso M.P.EP. § 71S.07 
and S 2138.04. 7th ed. 

4. From these documents and/or models, it can be seen that the invention In this applica- 
tion was made 

□ on 

0 at least by the date of 12/08/2003 , which Is a date earlier than the effective 

date of the reference. 

NOTE ’If the dates of the exhibits have been removed or blocked off, the matter of dates can be taken care 
of In the body of the oaffi or dedaratkn.’ MJPMJP. § 715.07, 8th ed 

NOTE ’{ T fire dates in the oath or declaration may be the actual dates, or. If the epplicant or patent owner 
does not desire to disclose his or her actual dates, he or she may merely aB^ that the acts referred 
to occurred prior to a specified date. However, the actual dates of acts r^ed on to establish diligence 
must be provided.’ M.P.EP. § 715.07. 8lh ed 



DIUGENCE 

NOTE: ’Where there has not been reduction to practice prior to the date of the reference, the applicant or 
patent owner must also show dWgetKe In tiK completion of Ns or her Invention from a time prior 
to the date of the reference continuousfy to the date of the actual reduction to practice or up to 
the date of filing his or her application (Nhg constitutes a constructive reduction to practice, § 1.131).’ 
M.P.EP. § 715.07, 8th ed.. 

NOTE ’A conception of an invention, though evidenced by disclosure, dramngs, and even a modN, is not 
a complete Invention under tiie pateN laws, and confers rto ri^ts on an inventor, and has no effect 
on a subsequently (yanted patent to another. UNLESS HE OR SHE FOLLOWS TT WITH REASONABLE 
aUGENCE BY SOME OTHER ACT. such as an actual reduction to practice or Wing an afyrtication for 
a patent Automatic W^ghing Mach. Co. v. Pneumatic Scale Corp., Limited 1909 C.D. 498, 139 O.G. 
991, M.P.EP. § 715.07, 8th ed 

‘Conception In the mental part of the Inventive act but it must be capable of proof, as by drawings, 
complete disclosure to another person, efa In Mergenthaler v. Scudder, 1897 C.D. 724, 81 O.G. 1417, 
it Mas estaNished that conception Is more than a mere vague Idea of how to solve a proUem; the means 
themselYes and their Interaction must be comprehended also.’ M.P.EP. $ 715.07, 8th ed. 

NOTE ’[0]nly diligence before reduction to practice Is a material consideration. The lapse of time between 
the completion or reduction to practice an Invention and the Wing of an application thereon' is not 
relevant to an affidavit or declaration tmder37 CFR 1.131. See Ex parte Metz, 75 USPQ 296 (Bd. App. 
1947)." MPEP § 715.07(a), 8th ed 
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5. Attached is a statement establishing the diligence of the applicants, from the time of 
their conception, to a time just prior to the date of the reference, up to the: 

O actual reductkMi to practice. 

Q filing of this application. 

TIME OF PRESENTATION OF THE DECLARATION 

(complete (^, jbj or (c)) 

0 This declaration is submitted prior to final rejection. 

(b) □ This declaration is submitted with the first response after final rejection, and is 

for the purpose of overcoming a new ground of rejection or requirement made 
in the final rejection. 

(c) □ This declaration is submitted after final rejection. A showing under 37 C.F.R. 

§ 1.116(b) is submitted herewith. 

DECLARATION 

6. As a person signing below: 

I hereby declare that all statements made herein of my own knowledge are true and that 
all statements made on information and beOef are believed to be true; and further that these 
statements were made with the knowledge that wlllfui false statements arxl the ike so made 
are punishable by fine or Imprisonment, or both, under Section 1001 of Title 18 of the United 
States Code, and that such willful false statements may jeopardize the validity of the 
appOcation or any patent issued thereon. 
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FORM 9-32 



9-196 
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SIGNATURE(S) 

7* (complete A or B below) 

A- lnventor(s) 

Full name of sole or first Inventor 

Inventor's signature 

Date Country of Citizenship 

Residence 

Post Office Address 



Full name of second Joint Inventor, If any 

inventor’s signature 

Date Country of CitizensNp 

Residence ~ 

Post Office Address ! 

(use added page for signature by adOtionsJ Inventors) 



B. Assignee 



Number of pages added: 



Hi 



Date 

IBM Corporation, SHCB/040-3 



Arthur J. Samodovitz. Rf6 No. 31, 297 

(type or print name of person signing) 



P.O. Address 

1701 North Street, Endicott, NY 13760 



International Business Machines Corporation 
(type name of assignee) 

New Orchard Road, ' Armonk, NY 10504. 

Address of assignee 



IP Counsel 

Title of person authorized to sign 
on behalf of assignee 

Assignment recorded in PTC on o^/i6/04 

Reel _ 01^525 0642 

A “CERTIFICATE UNDER 37 C.F.a § 3.73(b)" is attached. 

(Declaration of Prior Invention in the United States or in a NAFTA or WTO Member Country to Overcome 
Cited Patent or Publicafcn-S7 C.F.R. § 1.131 I9-323^age 5 of 5) 




PTO/SB/96 (01-08) 
Approved for use through 02/29/2008. OMB 0651-0031 
U.S. Patent and Trademark Office; U.S. DEPARTMENT OF COMMERCE 
Under the Paperwork Reduction Act of 1995, no person s are required to respond to a collection of information unless it displays a valid OMB control number. 

STATEMENT UNDER 37 CFR 3.73^b) 

Applicant/Patent Owner: John Fred Davis et al. 

Application No./Patent No.: 10/796,161 Filed/Issue Date: 03/09/2004 

Entitled: SYSTEM, METHOD AND COMPUTER PROGRAM TO BLOCK SPAM 




states that it is: 

1 . [^ the assignee of the entire right, title, and interest; or 

2. Q an assignee of less than the entire right, title and interest 

(The extent (by percentage) of its ownership interest is %) 

in the patent application/patent identified above by virtue of either: 

A{/]An assignment from the inventor(s) of the patent application/patent identified above. The assignment was recorded 

in the United States Patent and Trademark Office at Reel 014525 , Frame 0642 , or for which a copy 

thereof is attached. 

OR 

B.n A chain of title from the inventor(s), of the patent application/patent identified above, to the current assignee as follows: 



1 . From: To: 

The document was recorded in the United States Patent and Trademark Office at 
Reel , Frame , or for which a copy thereof is attached. 

2. From: To: 

The document was recorded in the United States Patent and Trademark Office at 
Reel , Frame , or for which a copy thereof is attached. 

3. From: To: 

The document was recorded in the United States Patent and Trademark Office at 
Reel , Frame , or for which a copy thereof is attached. 

I I Additional documents in the chain of title are listed on a supplemental sheet. 

I I As required by 37 CFR 3.73(b)(1 )(i), the documentary evidence of the chain of title from the original owner to the 
assignee was, or concurrently is being, submitted for recordation pursuant to 37 CFR 3.11. 



[NOTE: A separate copy (/.e., a true copy of the original assignment document(s)) must be submitted to Assignment 
Division in accordance with 37 CFR Part 3. to record the assignment in the records of the USPTO. See MPEP 
302.08] 




Printed or Typed Name Telephone Number 



IP Counsel 
Title 




IN THE UNITED STATES PATENT AND TRADEMARK OFFICE 



In re Patent Application: : Group Art Unit: 4121 

John Fred Davis et al. : Examiner: Matthew E. Kessler 

Serial No.: 10/796,161 : IBM Corporation 

Filed: 03/09/2004 : Intellectual Property Law 

Title: SYSTEM, METHOD AND COMPUTER : Department SHCB/040-3 

PROGRAM TO BLOCK SPAM : 1701 North Street 

Confirmation No. 3025 : Endicott, NY 13760 



Commissioner for Patents 
PO Box 1450 

Alexandria, VA 22313-1450 



Rule 131 Affidavit 

1 . A true copy of the Invention Disclosure dated September 27, 2003 entitled “Efficient 
Blocking of Spam Sources” is enclosed. 

2. A true copy of the an email from inventor, Clark Jeffries dated December 08, 2003 is 
enclosed. 

3. The present patent application 10/796,161 by John Fred Davis, et al. was filed on March 
9, 2004. 

4. US 2005/198159 by Kirsch was filed on March 8, 2004. 

5. The present patent application names four inventors who signed the Declaration on the 
following dates: 

John Fred Davis: March 3, 2004. 

Kevin David Himberg: March 1 , 2004 
Clark Debs Jeffries: March 1, 2004 
Garreth Joseph Jeremiah: March 5, 2004. 

6. March 5, 2004 was a Friday. 

7. March 5, 2004, the date of last execution of the Declaration, preceded the filing date of 
Kirsch. 



8. March 9, 2004 was a Tuesday. 



10/796,161 



1 



END920030160US1 




Only two business days elapsed from the execution of the Declaration by Garreth Joseph 
Jeremiah on Friday March 5, 2004 until the filing of the patent application on Tuesday March 9 
2004. 

9. A true copy of the Declaration is attached. 

I hereby declare that all statements made herein of my own knowledge are true and that 
all statements made on information and belief are believed to be true; and further that these 
statements were made with the knowledge that willful false statements and the like so made are 
punishable by fine or imprisonment, or both, under Section 1001, of Title 18 of the United States 
Code, and that such willful false statements may jeopardize the validity of the application or any 
patent issued thereon. 



Respectfully submitted. 

Dated: '// 

Phone: 607-429-4368 
Fax: 607-429-4119 




Arthur J. Samodovitz 
Reg. No. 31, 297 



10/796,161 
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Required fields are marked with the asterisk ( ) and must be filled in to complete the form . 



*Title of disclosure (in English) 

Efficient blocking of spam sources 

Summary 



Status 




Under Evaluation 


Final Deadline 


Final Deadline 
Reason 


‘Processing 

Location 




Endicott 


‘Functional Area 


select 


(Larry Longseth) GS-(LONGSETH) BOULDER Global Services 


Attorney/Patent Professional Arthur Samodovitz/Endicott/IBM 


IDT Team 


select 


Gerri Peper/Boulder/IBM 
Patrick Wong/San Jose/IBM 
Donald Schaefer/Boulder/IBM 
Fred Ris/Boulder/IBM 
Glenn Haggard/Phoenix/IBM 
Fred Ris/Boulder/IBM 


Submitted Date 




09/27/2003 05:43:38 AM ZE9 


‘Owning Division 


select 


GS 


‘Line of Business 




SO - Strategic Outsourcing Primary Inventor's Line of Business (LoB) 


‘Industry/Sector 




Finance - Banking 


‘Competency 




Technical Support 


Incentive 

Program 


Lab 




LONGSETH 


‘Technology 

Code 




740 


PVT Score 



Inventors with a Blue Pages entry 

Inventors: John F Davis/Raleigh/IBM@ibmus, KEVIN HIMBERGER/Raleigh/IBM@IBMUS, Clark D Jeffries/Raleigh/IBM, 



Garreth Jeremiah/Markham/IBM@IBMCA 

Inventor Name 


Inventor 

Serial 


Div/Dept 


Inventor 

Phone 


Manager Name 


Davis, John F. 
HIMBERGER, KEVIN D. 
> Jeffries, Clark D, 
Jeremiah, Garreth (G.J.) 


7A1688 

738588 

537014 

004235 


29/YM5A 

07/N48B 

07/N48B 

FN/G9U 


441-7985 

441-5361 

441-1429 

N/A 


Booker, Alan J. 

Lott, Jessica L. 

Lott, Jessica L, 
Wagner, Glenn (G.J.) 


> denotes primary contact 



Inventors without a Blue Pages entry 
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Arthur Samodovitz/Endicott/IBM 

Gerri Peper/Boulder/IBM 
Patrick Wong/San Jose/IBM 
Donald Schaefer/Boulder/IBM 
Fred Ris/Boulder/IBM 
Glenn Haggard/Phoenix/IBM 
Fred Ris/Boulder/IBM 
Response Due to IP&L 1 0/30/2003 

*Main Idea 

1 . Background: What is the problem solved by your invention? Describe known solutions to this problem 
(if any). What are the drawbacks of such known solutions, or why is an additional solution required? Cite 
any relevant technical documents or references. 

Current spammers sometimes own blocks of IP address space. For example, one spam company known 
to the inventors has about 16 different blocks of address space. Each block may be defined by a /24 
prefix, so it includes 256 distinct addresses. 

During a spam event, the receivers may detect spam and start to block the Source Address (SA) of the 
spam. The spammer only need shift the SA to another of the 256 values to escape simple filtering on the 
exact SA value. 

2. Summary of Invention: Briefly describe the core idea of your invention (saving the details for questions 
#3 below). Describe the advantage(s) of using your invention instead of the known solutions described 
above. 

The invention include blocking a range of addresses. For example, if the spammer owns all addresses of 
the form 10.20.30.*, defined in this example by 24 fixed bits and 8 arbitrary bits, then there are actually 
256 possible source addresses. All the source addresses could be blocked one by one, but that would 
imply 256 distinct filter rules. Firewall manufacturers typically caution administrators against using many 
filter rules, for example 500, due to the performance impact. 

The present invention includes, to continue the example, not blocking 256 distinct addresses, but blocking 
all 256 with one range filter rule. 

3. Description: Describe how your invention works, and how it could be implemented, using text, 
diagrams and flow charts as appropriate. 

The present invention includes adding a range filter rule to the firewall to block spam if several values 
within the range have been observed to be spam sources and if background research shows that one 
administration (one autonomous system) has been assigned the block of address values. 

The benefit of the invention is efficient blocking of sources of mass email distributions or spam. 

'Patent Value Tool 

* 1 . Select the single most appropriate technology category for your invention from the following 
technologies list. 

(740) Tech Tag 700 Network Computing-740 Network Management - Path Finding - Traffic Control - 
Measurement Network Security; Network Interface Control; Node management message authentication; 
Network Architecture; Network Access; Network Transport; Network Switching; Packet Switching 
Comments 

Are there any additional significant markets where the invention is likely to have impact? 

Yes # No 

*2. Have you implemented the invention (e.g., made a prototype) or otherwise shown that it is workable? 



IDT Selection 

Attorney/Patent 
Professional 
IDT Team 
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# Yes No 

*3. Has the subject matter of the invention or a product incorporating the invention been offered for sale, 
or is it likely to be offered for sale, as part of an IBM product or service? 

No known product plans within 2 years 

# Maybe; GA 1-2 years away 
Yes; GA within 3-12 months 
Yes; GA within 3 months 

Yes; product has been announced 

What product? 

Possibly included in some future version of Billy Goat. 

What is the significance of the invention within the product? 

Improves general usability 
Enables a minor feature 

# Enables a major feature 

What feature? 

Efficient blocking of spam 

* 4 . Has the invention been commercially used (internally or externally) by IBM or another entity (e.g., 
included in or used to make products, or prototypes provided to a customer)? 

Yes • No 

*5. In what type of product might a competitor include the invention? 
firewall or router capable of filtering 

What competitor(s) (indicate home country of such competitors if not United States)? 

All devices that filter spam at a firewall. 

*6. How easily can the use of the invention by a third party be detected? 

Undiscoverable; third party must admit use for IBM to know 
Difficult; e.g.; with reverse engineering or examination of available code 
With work; e.g.; using test cases; but not reverse engineering 

# Easily; by running & viewing product operation 

Trivally; without purchase of product; e.g.; by reading product literature 

Please propose how a test would be performed and what test methods may be required: 

Attempt to pass traffic with spam behavior and a Source Address range of values defined by a prefix 
such as 10.20.30.* through a firewall in a lab. 

*7. Is the invention applicable to a standard? 

Yes # No 

*8. Have you, or any of the other inventors, submitted this invention disclosure or a similar invention 
disclosure previously? 

# Yes No 

Please provide the disclosure number: END 8 2003 0163 

**9. Please list the invention disclosures (previously submitted or about to be submitted), products, 
patents, or publications that you and the other inventors feel are the most relevant to your invention 
(e.g., pertaining to the problem you are solving, including other solutions to the problem), be they from 
you or anyone else, or if not applicable, enter "None": 

END 8 2003 0163 

* 10 . Was the invention made in the course of any activity that involved any other party, be it 
• The government 
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• A customer (such as an RFQ) 

• A development partner 

• An alliance 

• Any contract activity 

• As part of a standards setting activity 

• Other persons not employed by IBM 
Yes • No 

*11. Have you ever disclosed your invention to anyone outside IBM, or do you plan to do so in the future? 
Yes • No 

*12. If the invention relates to a product or service that is outside the scope of your business unit, please 
recommend IBM business unit(s), IBM location(s) or individual(s) within IBM that you think would 
provide a competent evaluation of your invention: 

*PVT II 

All of the questions below are required and must be answered in order to calculate a PVT Score 

A. Threshold Questions 

*1. Operability - Is there an identifiable operable embodiment of the invention (i.e., an embodiment that 
has been demonstrated or that would be reasonably expected to provide the benefits of the invention)? 
Yes No 

Reasons for above answer: 

*2. Novelty- Are one or more concept(s) of the invention novel over what is already known in the 
literature, existing commercial products, patents, and earlier IBM invention disclosures? 

Yes No 

Reasons for above answer: 

B. Valuation Questions 

*1. Adequacy of Description: 

Inadequate; invention unclear from description 
Incomplete; essential features missing 
Further clarification or implementation detail needed 
Clear and complete as is 
State reason for answer: 

*2. Technical contribution of invention: 

None 

Minor addition to known technology 
Significant addition to known technology 
Major advance in technology 
Reasons for above answer: 

*3. Describe the problem solved/benefit provided and the implementation cost of the invention compared 
to existing or reasonably expected alternatives: 

Minor problem/incremental benefit - significant implementation cost 
Significant problem; substantial benefit - significant implementation cost 
Minor problem/incremental benefit - minor implementation cost 
Significant problem/substantial benefit - minor implementation cost 

*4. Are any alternatives to the invention available to those wishing to avoid its use? 
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Suitable alternatives available 
Alternatives have drawbacks 
No feasible alternatives 
Reasons for above answer: 



*5. Describe the likeiihood of use of the invention (answer each): 
IBM's customers? Unlikely Possible Probable 

IBM's suppliers/vendors? Unlikely Possible Probable 
IBM's competitors? Unlikely Possible Probable 



IBM? 

Reasons for above answer: 



Definite 

Definite 

Definite 



Unlikely Possible Probable Definite 



*6. What % of third party products in the technical field will likely contain the invention? 

< 25% 

25-50% 

50-75% 

> 75% 

Reasons for above answer: 

*7. How long is the invention likely to be used in products by IBM or others? 

< 5 years 
5-10 years 
10-15 years 

> 1 5 years 

Reasons for above answer: 

*8. How easily can use of the invention by a third party be detected? 

Undiscoverable; third party must admit use for IBM to know 
Difficult; e.g.; with reverse engineering or examination of available code 
With work; e.g.; using test cases; but not reverse engineering 
Easily; by running & viewing product operation 
Trivially; without purchase of product; e.g.; by reading product literature 
Reasons for the above answer, including description of how use could be detected: 



Post Disclosure Text & Drawings 

To add additional information related to this disclosure once it has been submitted, click the action button 
below and a new document will be opened for you to enter the new information. To view existing post 
disclosure information, double-click on the item in the list below (if there has been additional information 
entered), and the document will open for you to view. 

Date entered Post disclosure information (comments and drawings) 
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From: 

To: 

cc: 

From: 

Subject: 



Clark D Jeffries on 12/08/2003 01:59 PM 



Arthur Samodovitz/Endicott/IBM@lBMUS 

John F Davis/Raleigh/IBM@ibmus. KEVIN HIMBERGER/Raleigh/IBM@IBMUS, Garreth 

Jeremiah/Markham/IBM@IBMCA 

Clark D Jeffries/Raleigh/IBM@IBMUS 

*IBM Confidential: suggested figures for RSW8 2003 0193 



Arthur, 

Following our conversation Fri 5 Dec. I suggest the following figures and captions for RSW8 2003 0193. 
The figures and captions pertain to efficient blocking of some kinds of spam sources by ranges of Source 
Addresses They are very similar to the figures and captions for RSW8 2003 0192 (filter rules that are 
rate limits as opposed to absolute blocks). However, there are a few changes in Fig 1 , Fig 2, and in 
their captions. 

Clark 



Figure 1 100 depicts the arrival of inbound traffic 102 at a firewall or router 110 capable of classifying 
packets according to some or all bits in the Internet Protocol (IP) Source Address (SA) and dropping 
some packets within a given range of SA values. Traffic that is not dropped (initially all traffic) passes 
1 04 to a server 1 1 2 supporting a Message Transfer Agent and other mail services. A spam detection 
mechanism in the server may learn that a particular SA is likely or certainly a source of spam and pass 
120 that information to a Range finder 130. The mail server may delete some email that is likely or 
certainly spam. Remaining email is passed 106 to the in-box of a User 114. The User 1 14 may by 
additional mechanisms conclude that additional SA values are also likely or certainly spam sources and 
report that information 122 to the Range finder 130. The Range finder 130 digests information and 
creates or deletes (times out) filter rules the enforcement of which cause dropping packets with an SA in 
a range deduced by the Range finder. The Range finder 130 may declare filter rules using the Internet 
Assigned Numbers Authority (lANA) or some other mechanism that suggests ranges of SA values are 
about as likely as the found SA value to be spam sources. The filter rules are actually enforced in the 
firewall or router 110. The results of algorithms running in 130 are passed 140 to a Monitor computer 
132. The Monitor digests information to create for each rule a time to add the rule to the Action 
Database 134, a life period for the rule, and a time to delete the rule. This information is passed 142 to 
an Actions Database (DB) 134. The Actions DB 134 records and transmits 144 add or delete instructions 
for rules to the firewall or router 110. 

Figure 2 200 depicts a flowchart for the present invention. The system starts 202 and simultaneously 
listens for either MTA spam detection 204 or User declared spam detection 206. If either is detected, the 
system goes to 208 at which state the Source Address (SA) of the spam traffic is extracted. After 
consideration of lANA or other information, this leads 210 to creation of a range of SA values to block. 

A range rule is created 212 to send to the add to the filter rules. This creation takes place in the Range 
finder 1 30 of Figure 1 . The Range finder passes the ranges to the Monitor 1 32 of Figure 1 . The Monitor 
first creates a start time and initial period 220 for enforcement of a rate limit. The rate limit is transmitted 
to the firewall or router 1 1 0 of Figure 1 . Then the system observes current time 222 and compares 
current time to the initial time plus the initial period for each rate limit rule. The rule is continuously 
enforced 224 so long as current time is smaller than start time plus period. That is. the rule appears in 
the Actions Database 134 of Figure 1 and is enforced by the firewall or router 1 10 of Figure 1 . Otherwise 
the enforcement stops 226 and the system retests for persistence of spam behavior of the SA 228. If 
spam behavior continues 230 then the start time and period of the rate limit rule for the SA are refreshed 
232. That refreshed Information is passed to the time comparitor 222. If spam behavior does not 
continue 230, then the rule is deleted from the Actions Database 134 of Figure 1 and the firewall or 




router 110 of Figure 1. 
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